fix(applier): fail closed when a gate-context derivation fetch fails

scripts/apply-branch-gates.sh

@@ -66,7 +66,9 @@
 #   --gates-file F     default config/rulesets/gates.json
 #   --strip-retired    also remove the 4 retired rule types. Off by default.
 #   --require-green N  drop any derived context that is not green across the
-#                      last N default-branch runs of its workflow. Off (0) by
+#                      last N default-branch runs of its workflow, and REFUSE
+#                      the repo outright if any of those runs cannot be read.
+#                      Off (0) by
 #                      default. Owner ruling on #956: "require the reliably-
 #                      green set" -- a required context that is currently red
 #                      blocks the branch the moment it is required, so gating
@@ -210,14 +212,32 @@
   done < "$WORK/gatewf"
 
   # ---- 2. DERIVE contexts from real runs --------------------------------
-  : > "$WORK/ctx"; NORUN=''
+  # FAIL CLOSED.  A swallowed API error here raises nothing -- it silently
+  # SHORTENS the list, and the gate is written weaker than intended while
+  # every other line of output still reports success.  (Measured 2026-09-22:
+  # this dropped 2 of 18 required contexts on standards/main.)  So capture
+  # the exit status of every fetch and refuse to write if any one failed.
+  : > "$WORK/ctx"; : > "$WORK/gatewf3"; NORUN=''; DERIVEFAIL=''
   while IFS= read -r WFN; do
     [ -n "$WFN" ] || continue
-    RID=$(gh api "repos/$R/actions/workflows/$WFN/runs?branch=$DEF&per_page=1" \
-            --jq '.workflow_runs[0].id // empty' 2>/dev/null)
+    if ! RID=$(gh api "repos/$R/actions/workflows/$WFN/runs?branch=$DEF&per_page=1" \
+                 --jq '.workflow_runs[0].id // empty'); then
+      DERIVEFAIL="${DERIVEFAIL:+$DERIVEFAIL,}$WFN(runs-query-failed)"; continue
+    fi
     if [ -z "$RID" ]; then NORUN="${NORUN:+$NORUN,}$WFN"; continue; fi
-    gh api "repos/$R/actions/runs/$RID/jobs?per_page=100" --paginate \
-      --jq '.jobs[]?|.name' 2>/dev/null >> "$WORK/ctx"
+    if ! gh api "repos/$R/actions/runs/$RID/jobs?per_page=100" --paginate \
+           --jq '.jobs[]?|.name' > "$WORK/jobs1"; then
+      DERIVEFAIL="${DERIVEFAIL:+$DERIVEFAIL,}$WFN(jobs-query-failed)"; continue
+    fi
+    # a run that EXISTS but reports zero jobs is a failed read, not an empty gate
+    if [ ! -s "$WORK/jobs1" ]; then
+      DERIVEFAIL="${DERIVEFAIL:+$DERIVEFAIL,}$WFN(run $RID returned zero jobs)"; continue
+    fi
+    cat "$WORK/jobs1" >> "$WORK/ctx"
+    # Record the workflows that actually CONTRIBUTED contexts.  The greenness
+    # probe below must iterate these, not gatewf2: gatewf2 still holds every
+    # NORUN workflow, for which an empty runs query is the LEGITIMATE state.
+    printf '%s\n' "$WFN" >> "$WORK/gatewf3"
   done < "$WORK/gatewf2"
 
   sort -u "$WORK/ctx" -o "$WORK/ctx"
@@ -229,22 +249,53 @@
   done < "$WORK/ctx"
 
   # ---- optional: keep only contexts that are RELIABLY green ------------
+  # The same rule in the other direction: an UNREAD run cannot prove a
+  # context green, so a failed fetch here must refuse, never silently admit.
   NOTGREEN=''
   if [ "$REQUIRE_GREEN" -gt 0 ] 2>/dev/null; then
     : > "$WORK/bad"
     while IFS= read -r WFN; do
       [ -n "$WFN" ] || continue
-      gh api "repos/$R/actions/workflows/$WFN/runs?branch=$DEF&per_page=$REQUIRE_GREEN" \
-        --jq '.workflow_runs[]?.id' 2>/dev/null > "$WORK/rids"
+      if ! gh api "repos/$R/actions/workflows/$WFN/runs?branch=$DEF&per_page=$REQUIRE_GREEN" \
+             --jq '.workflow_runs[]?.id' > "$WORK/rids"; then
+        DERIVEFAIL="${DERIVEFAIL:+$DERIVEFAIL,}$WFN(green-runs-query-failed)"; continue
+      fi
+      # Third instance of the same class.  A runs query that SUCCEEDS with an
+      # empty list leaves rids empty, the loop below never runs, nothing lands
+      # in "bad", and every context this workflow contributed is admitted as
+      # green.  We are iterating gatewf3 -- workflows that DID contribute
+      # contexts, hence had a run -- so zero runs here is a failed read.
+      if [ ! -s "$WORK/rids" ]; then
+        DERIVEFAIL="${DERIVEFAIL:+$DERIVEFAIL,}$WFN(green-runs-query-returned-none)"; continue
+      fi
       while IFS= read -r RID2; do
         [ -n "$RID2" ] || continue
+        # Ask for NAME + CONCLUSION of every job and classify locally.
+        # Asking the API only for the NON-green jobs cannot tell "this run is
+        # all green" apart from "this run was not read": both return ZERO
+        # lines, and zero lines is read as greenness. That is the same
+        # fail-open as the derivation loop above, pointing the other way --
+        # there it SHORTENS the gate, here it ADMITS a context that was never
+        # shown to be green. An unread run proves nothing in either direction.
+        if ! gh api "repos/$R/actions/runs/$RID2/jobs?per_page=100" --paginate \
+               --jq '.jobs[]? | [.name, (.conclusion // "pending")] | @tsv' \
+               > "$WORK/jobs2"; then
+          DERIVEFAIL="${DERIVEFAIL:+$DERIVEFAIL,}$WFN(run $RID2 green-check-failed)"; continue
+        fi
+        # a run that EXISTS but reports zero jobs is a failed read, not a green run
+        if [ ! -s "$WORK/jobs2" ]; then
+          DERIVEFAIL="${DERIVEFAIL:+$DERIVEFAIL,}$WFN(run $RID2 returned zero jobs)"; continue
+        fi
         # a job is acceptable when success/skipped/neutral, or still running
-        gh api "repos/$R/actions/runs/$RID2/jobs?per_page=100" --paginate \
-          --jq '.jobs[]? | select((.conclusion // "pending") as $c
-                 | ["success","skipped","neutral","pending"] | index($c) | not) | .name' \
-          2>/dev/null >> "$WORK/bad"
+        while IFS=$'\t' read -r JN JC; do
+          [ -n "$JN" ] || continue
+          case "$JC" in
+            success|skipped|neutral|pending) ;;
+            *) printf '%s\n' "$JN" >> "$WORK/bad" ;;
+          esac
+        done < "$WORK/jobs2"
       done < "$WORK/rids"
-    done < "$WORK/gatewf2"
+    done < "$WORK/gatewf3"
     sort -u "$WORK/bad" -o "$WORK/bad"
     : > "$WORK/ctx3"
     while IFS= read -r C; do
@@ -261,6 +312,15 @@
   [ -n "$NORUN" ]   && DETAIL="$DETAIL no_run=[$NORUN]"
   [ -n "$EXCLUDED" ] && DETAIL="$DETAIL excluded=[$EXCLUDED]"
 
+  # ---- THE OTHER REFUSAL: a gate derived from an incomplete read --------
+  # An unread run is not an absent context.  Writing here would produce a
+  # real, plausible, permanent ruleset that is simply WEAKER than intended,
+  # reported as success, with nothing anywhere to say so.
+  if [ -n "$DERIVEFAIL" ]; then
+    emit "$R" "REFUSED" "$DETAIL derive_failed=[$DERIVEFAIL] — refusing to write a gate derived from an incomplete read"
+    continue
+  fi
+
   # ---- THE REFUSAL: a rule with an empty list is a vacuous gate ---------
   if [ "$NCTX" -eq 0 ]; then
     emit "$R" "UNGATED" "$DETAIL — refusing to write an empty required_status_checks rule"